5dcfac410a8ac5371ec25cbf19002209f1d52c7429ea992e2efd965ff55d4fa9
- SHA256 5dcfac410a8ac5371ec25cbf19002209f1d52c7429ea992e2efd965ff55d4fa9
Overview
overview
10Static
static
10e0324f9407...c3.exe
windows7-x64
10e0324f9407...c3.exe
windows10-2004-x64
10e046c5e3f0...9f.exe
windows7-x64
9e046c5e3f0...9f.exe
windows10-2004-x64
10e226857f5c...7f.elf
ubuntu-18.04-amd64
e226857f5c...7f.elf
debian-9-armhf
e226857f5c...7f.elf
debian-9-mips
e226857f5c...7f.elf
debian-9-mipsel
e268df66fb...75.exe
windows7-x64
10e268df66fb...75.exe
windows10-2004-x64
10e449991296...3a.vbs
windows7-x64
8e449991296...3a.vbs
windows10-2004-x64
7e4dafea026...82.elf
debian-9-mipsel
10e500b83db9...5a.exe
windows7-x64
7e500b83db9...5a.exe
windows10-2004-x64
7e586bf1756...15.exe
windows7-x64
10e586bf1756...15.exe
windows10-2004-x64
9e5b92c6426...5a.exe
windows7-x64
10e5b92c6426...5a.exe
windows10-2004-x64
10e6152cc470...49.exe
windows7-x64
10e6152cc470...49.exe
windows10-2004-x64
10e7757fdf8b...c8.exe
windows7-x64
10e7757fdf8b...c8.exe
windows10-2004-x64
10e8028be583...3f.exe
windows7-x64
7e8028be583...3f.exe
windows10-2004-x64
7e8ba4a43b8...ab.exe
windows7-x64
10e8ba4a43b8...ab.exe
windows10-2004-x64
10eac1ffc2d9...ad.elf
ubuntu-18.04-amd64
eac1ffc2d9...ad.elf
debian-9-armhf
eac1ffc2d9...ad.elf
debian-9-mips
eac1ffc2d9...ad.elf
debian-9-mipsel
ec291f7213...3b.exe
windows7-x64
10Static task
static1
Behavioral task
behavioral1
Sample
e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
e046c5e3f0ead64c214eaa411189b0001bdc5431f3a942d0e6fff1ba87fadb9f.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
e046c5e3f0ead64c214eaa411189b0001bdc5431f3a942d0e6fff1ba87fadb9f.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
e226857f5c5f9a274825a537fe84a8d636b5d920368f20206089a99b56d7de7f.elf
Resource
ubuntu1804-amd64-20240221-en
Behavioral task
behavioral6
Sample
e226857f5c5f9a274825a537fe84a8d636b5d920368f20206089a99b56d7de7f.elf
Resource
debian9-armhf-20240221-en
Behavioral task
behavioral7
Sample
e226857f5c5f9a274825a537fe84a8d636b5d920368f20206089a99b56d7de7f.elf
Resource
debian9-mipsbe-20240221-en
Behavioral task
behavioral8
Sample
e226857f5c5f9a274825a537fe84a8d636b5d920368f20206089a99b56d7de7f.elf
Resource
debian9-mipsel-20240221-en
Behavioral task
behavioral9
Sample
e268df66fb92ff6e5b2719279c5bee5383d56a4b97add2c7dc0ede45d2aec175.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
e268df66fb92ff6e5b2719279c5bee5383d56a4b97add2c7dc0ede45d2aec175.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral11
Sample
e4499912964280ec3adc3131a12d5415a577bcd29d7259a38e928ba87ad6c03a.vbs
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
e4499912964280ec3adc3131a12d5415a577bcd29d7259a38e928ba87ad6c03a.vbs
Resource
win10v2004-20240221-en
Behavioral task
behavioral13
Sample
e4dafea0263823affefe445b40ea002c5f63b785cb3b18270b045b86b22ba682.elf
Resource
debian9-mipsel-20240221-en
Behavioral task
behavioral14
Sample
e500b83db91a16021dc5f38a5cfacd4262a43c34bba5fa7211409e0ace06c85a.exe
Resource
win7-20240221-en
Behavioral task
behavioral15
Sample
e500b83db91a16021dc5f38a5cfacd4262a43c34bba5fa7211409e0ace06c85a.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral16
Sample
e586bf17566b9188b9274097ddf059cf20569b87754f38e460c2fd884ae88a15.exe
Resource
win7-20240221-en
Behavioral task
behavioral17
Sample
e586bf17566b9188b9274097ddf059cf20569b87754f38e460c2fd884ae88a15.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral18
Sample
e5b92c64269cc60d8db665c2a71cf0b7c917bb0585d833324f6e8c3a1d22025a.exe
Resource
win7-20240221-en
Behavioral task
behavioral19
Sample
e5b92c64269cc60d8db665c2a71cf0b7c917bb0585d833324f6e8c3a1d22025a.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral20
Sample
e6152cc4702000546accc8d72aed7cb2a17381fbfed6b2dae32a336e15440549.exe
Resource
win7-20240221-en
Behavioral task
behavioral21
Sample
e6152cc4702000546accc8d72aed7cb2a17381fbfed6b2dae32a336e15440549.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral22
Sample
e7757fdf8b8e6b584cab959c54383e10065ba2aceb5dd653dd0566d4cbce1ec8.exe
Resource
win7-20240221-en
Behavioral task
behavioral23
Sample
e7757fdf8b8e6b584cab959c54383e10065ba2aceb5dd653dd0566d4cbce1ec8.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral24
Sample
e8028be583b1ea12a054ac8ae37abb2356e37f7c0aeff0ee40c17c9ac219973f.exe
Resource
win7-20240221-en
Behavioral task
behavioral25
Sample
e8028be583b1ea12a054ac8ae37abb2356e37f7c0aeff0ee40c17c9ac219973f.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral26
Sample
e8ba4a43b8c03e1ea3ab83bed7c1c415cd17a289293a1e0e351da3ba85683eab.exe
Resource
win7-20240215-en
Behavioral task
behavioral27
Sample
e8ba4a43b8c03e1ea3ab83bed7c1c415cd17a289293a1e0e351da3ba85683eab.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral28
Sample
eac1ffc2d94146ca2f9ae011468a19552430c78fc5c306dcf2d98edaf5273ead.elf
Resource
ubuntu1804-amd64-20240221-en
Behavioral task
behavioral29
Sample
eac1ffc2d94146ca2f9ae011468a19552430c78fc5c306dcf2d98edaf5273ead.elf
Resource
debian9-armhf-20240221-en
Behavioral task
behavioral30
Sample
eac1ffc2d94146ca2f9ae011468a19552430c78fc5c306dcf2d98edaf5273ead.elf
Resource
debian9-mipsbe-20240221-en
Behavioral task
behavioral31
Sample
eac1ffc2d94146ca2f9ae011468a19552430c78fc5c306dcf2d98edaf5273ead.elf
Resource
debian9-mipsel-20240221-en
mirai
UNSTABLE
unratio.funpass.services
scamanje.stresserit.pro
mirai
WICKED
agenttesla
https://api.telegram.org/bot7013847015:AAGJ9U6sgMmsBCQ0DNkHT8DYuslAtpiqCbA/
gafgyt
185.91.127.233:23
103.82.20.7:42516
93.123.39.166:671
mirai
UNSTABLE
unratio.funpass.services
scamanje.stresserit.pro
mirai
scan.rebirthltd.dev
love.booter.cat
mirai
WICKED
mirai
BOTNET
scan.rebirthltd.dev
194.169.175.31
mirai
MIRAI
mirai
UNST
njrat
im523
Hacked
0.tcp.eu.ngrok.io:19599
3a8ee47129614a8ed745ed44d22e4759
3a8ee47129614a8ed745ed44d22e4759
|'|'|
mirai
UNSTABLE
unratio.funpass.services
scamanje.stresserit.pro
mirai
MIRAI
mirai
UNSTABLE
unratio.funpass.services
scamanje.stresserit.pro
revengerat
NyanCatRevenge
marcelotatuape.ddns.net:333
13b150f8ef23499092
mirai
WICKED
mirai
scamanje.stresserit.pro
mirai
WICKED
njrat
0.7NC
NYAN CAT
patria.duckdns.org:1998
85f10a8a09aa4
85f10a8a09aa4
@!#&^%$
mirai
WICKED
mirai
MIRAI
mirai
UNSTABLE
unratio.funpass.services
scamanje.stresserit.pro
mirai
UNSTABLE
unratio.funpass.services
scamanje.stresserit.pro
mirai
WICKED
nanocore
1.2.2.0
0.tcp.ngrok.io:18237
127.0.0.1:18237
25d94285-e644-4394-8a59-361d828035f4
true
127.0.0.1
8.8.4.4
65535
2023-11-29T08:14:25.249811736Z
true
true
false
3988
18237
Default
true
1.048576e+07
30000
false
2500
1.048576e+07
25d94285-e644-4394-8a59-361d828035f4
5000
false
0.tcp.ngrok.io
8.8.8.8
true
5000
0
false
true
5000
false
1.2.2.0
8000
amadey
4.18
http://147.45.47.35
0a25b59f74
Dctooux.exe
57658e7aa84093060e0ebefa5ad4aa45
/bDjkb2xSd/index.php
mirai
LZRD
njrat
0.7d
Hacked
amma.myftp.biz:1177
5067798511594293a736c9b0b92fa333
5067798511594293a736c9b0b92fa333
|'|'|
mirai
SORA
mirai
SORA
amadey
4.18
http://147.45.47.35
57658e7aa84093060e0ebefa5ad4aa45
/bDjkb2xSd/index.php
njrat
im523
Лошок
5.tcp.eu.ngrok.io:13326
1c7d94c93e29463dd3914e19ee6714b6
1c7d94c93e29463dd3914e19ee6714b6
|'|'|
mirai
LZRD
mirai
BOTNET
scan.rebirthltd.dev
194.169.175.31
| resource | yara_rule |
|---|---|
| static1/unpack001/7de8bedc1d2107a51363439e1f9c58e0631256b3bb6141545e953d25570e4511.exe | dcrat |
| static1/unpack001/924d37ab763e5093673e647251deab171e2d03926ba159593e6352373c29de00.exe | dcrat |
| resource | yara_rule |
|---|---|
| static1/unpack001/25ab561d014bdd7b50d5fa913d111bcb4dd3e41d22a5850764a7659aece4d33f.exe | family_zgrat_v1 |
| static1/unpack001/9bf4636e2be3154a2c956982b1e547b7206b73bce86a42ce6573404c1773ce40.exe | family_zgrat_v1 |
| resource | yara_rule |
|---|---|
| static1/unpack001/0cc3fa35c0667389b3d40f296bbb73d627081dcf6663610d2cc9265d9ad1ad0b.elf | family_gafgyt |
| static1/unpack001/2212c7a616eec9c8b885e648011b7ecf15052d42ef2f7362203f2dfa9df7da25.elf | family_gafgyt |
| static1/unpack001/272cf1862c16c9b067ef5da9b099868e72592445cedb1f7dc286ff3359c9e324.elf | family_gafgyt |
| static1/unpack001/36e1aeaae5d1bffc4668bb646707d1fd9d4755cff6f32546c1abe310cf7293ac.elf | family_gafgyt |
| static1/unpack001/37417a9fe7c534e24386cc20c54ef3c998a0bec3577b1865c17387c5b64c92e2.elf | family_gafgyt |
| static1/unpack001/42b076c5ee3c60d65ef357ed908f9ee22ff38e826daa782071e8509780f4fc14.elf | family_gafgyt |
| static1/unpack001/45b18df80235f8ea55ec98b9b4bdd90cffaa1100b0edce53fc5d459503c84103.elf | family_gafgyt |
| static1/unpack001/489d7dbcfb918e3246f10029be18b5f2030b726ce4068909da4325c8dec20340.elf | family_gafgyt |
| static1/unpack001/539f3569eaf4a4a21eb6f9ee3b871334ec8a2628ec3b95bdfc3987adaf440037.elf | family_gafgyt |
| static1/unpack001/5942ecac81d81dc1ff1dd3cf1572669a02d2873117918e6a09b1573dd48e8d48.elf | family_gafgyt |
| static1/unpack001/6cfa5e1884dc7377cc8e3037592aba2ce7623a24838e8b58720695965ebc5231.elf | family_gafgyt |
| static1/unpack001/7e2165bfa732e207a3b268f091f7c1f9b545c7e4d88e621638ba3ade2f2ead83.elf | family_gafgyt |
| static1/unpack001/85da573dc8db0b1fc419d2a657dc0c5c3f1043b9f326b8392ee24f017d911f3d.elf | family_gafgyt |
| static1/unpack001/8898413844f25bf36791cdd187400681583f68496c3110df1ffb760e8fd5220d.elf | family_gafgyt |
| static1/unpack001/8ad2a922e44bb31dd225fb71a49fc9dfe9a9243a562a2ad9a2438f1730be3035.elf | family_gafgyt |
| static1/unpack001/8dcf670df8f445e76567c9c4f0c42533bd2b803a272b30bbd1f990d76669f25a.elf | family_gafgyt |
| static1/unpack001/8dda66a34a941d1bb2c9ab9ab12cab7e891d8b8c6a340697f634960738eb682c.elf | family_gafgyt |
| static1/unpack001/921563ee385a90abbeee3359d823750bea3f208c6f2a9fcaf83afaf59329eee1.elf | family_gafgyt |
| static1/unpack001/9cf2f0dd81ebd23d87f5ab55cf9980f1edd3b605c61032460085668685bfdb18.elf | family_gafgyt |
| static1/unpack001/a43e9ac03c240047c8a01173a8f0f50bbc27994eca0e38e2681145f814055db3.elf | family_gafgyt |
| static1/unpack001/a6360cf07cce2f6d339ac7db526fdbd78c3c4f50bdeacd080aac981f502dbd17.elf | family_gafgyt |
| static1/unpack001/a647913c3915c9a849bee272e91b5dbde205999505b5314661c2641a5e7c51a9.elf | family_gafgyt |
| static1/unpack001/a73d853722187c24804ed6c63419904345573d844c10758dd7bb5048e6651835.elf | family_gafgyt |
| static1/unpack001/aa1169180af01000df2cdecdd024ef7d5e012c36d38efcdde52f8f02026352da.elf | family_gafgyt |
| static1/unpack001/ad1bf6351e725b287a487eeeb93215733496f3850e4fe87ad3c2896c65576cb4.elf | family_gafgyt |
| static1/unpack001/c8cbfff1ed87fed6640c19321e3a2830b15b5128c9f36b8f4eb7462564571f31.elf | family_gafgyt |
| static1/unpack001/d2a5ee5a8ed5150ea84c6375e0715554dd62c3d8311cb8adec500643815584cf.elf | family_gafgyt |
| static1/unpack001/dc798cedc27aaa2f8749b5daddeace77fe21489f5a3372dc08488a7e2c76dcaf.elf | family_gafgyt |
| static1/unpack001/e226857f5c5f9a274825a537fe84a8d636b5d920368f20206089a99b56d7de7f.elf | family_gafgyt |
| static1/unpack001/f5adbe090b5da815ac42c166f4db33c1198725d793050541fc8897eca49c7df9.elf | family_gafgyt |
| resource | yara_rule |
|---|---|
| static1/unpack001/b5ab87692109c072cc277246e957ab32cfce6973f9f06c609ba51b53114cce51.apk | family_slocker_1 |
Office document macro which triggers in special circumstances - often malicious.
| resource | yara_rule |
|---|---|
| static1/unpack001/2bfe10b56aab056697477d8c4d3311a01cea0f071dd0e891bacf10b8fee84bc1.xlsx | office_macro_on_action |
| resource |
|---|
| static1/unpack001/275c050d461f4215f18321e15eaed51b0443ab0605de50996d11a5c048ed96e1.xlsx |
| resource | yara_rule |
|---|---|
| static1/unpack001/078981526fd0969e928c1b785c9e1da97ff159248dabf04132ea8fab9347acf6.exe | themida |
| static1/unpack001/e046c5e3f0ead64c214eaa411189b0001bdc5431f3a942d0e6fff1ba87fadb9f.exe | themida |
| resource | yara_rule |
|---|---|
| static1/unpack001/0386b038402a99ab607a9b0ceb469d25f563f34b3d5c1548751c6b9c7843e653.elf | upx |
| static1/unpack001/0f20ea70b1f2475ccf08bbe2646847f7693c259f10f32d158e018a97e38dadfa.elf | upx |
| static1/unpack001/19306dccfc2c25d953a83cc279cfc641d87818c6eca93d23c3aa507bdd400870.elf | upx |
| static1/unpack001/22cbfcd2ffb7a7c5901d89d03aa47ebdfd0238e9651f5d81cf81ab844f7c5d62.elf | upx |
| static1/unpack001/23576768ebb962854a01728f5de0dd55de0b681f40dfc15d40fe651e7f1d6cae.elf | upx |
| static1/unpack001/26cdb48348c94a289cdf8a1004575ba52da191672edb82624dd333413bb13150.elf | upx |
| static1/unpack001/3ab8ff44da4ed2af8c938e7a1340f190c0aef20d857933ce766ba91b6ddf527f.elf | upx |
| static1/unpack001/432825784a9d7b30a14ee513b59fb849b5c73166b0fd6ff46276c40584cab2dd.elf | upx |
| static1/unpack001/4419d55c1a6cb9ac9be272c04af5b8c21e2ae3a97b183d43dc6d9cf8f5e44b5a.elf | upx |
| static1/unpack001/48bc82d0984afc57dce0c4cc9444769cf9cae618130778ab9d588849410c5b59.elf | upx |
| static1/unpack001/4fe4fa8dab6190661ce264db75129553886d56a863312b79e50b227f16099d19.elf | upx |
| static1/unpack001/58ad53154bab1862392708b89b01c7851d11093d7a7d69cc2a6256fe6546448b.elf | upx |
| static1/unpack001/5ffc61aad552fb2349ac6567202a5100f0f5f1404108e285dba218d97764ae3a.elf | upx |
| static1/unpack001/65ff2a35d7542764e4e83ef824346341f95a2c22b6135d3d48899d1efbf87d38.elf | upx |
| static1/unpack001/72458cae5c7d963dbe4b470e00917f4c66fc2082672a945ed7c96353d17a57f9.elf | upx |
| static1/unpack001/76c142ca9d7c521e8df9a0cecd738b4657e107664a16174ec13f12ca275ee240.elf | upx |
| static1/unpack001/7c3f720c02708542fa45f50521b169f59053ff6a4a202c947b71037826bdfc31.elf | upx |
| static1/unpack001/8267f3195cca8c7854ec0c4a460f41bb345a89f299a4702358beffda6cec358a.elf | upx |
| static1/unpack001/8fd2101e6ed38b5546ed69a0acfe7ecda6f819e421f32939c5a7b56c74b92e2d.elf | upx |
| static1/unpack001/9a3e5baf097ea6a7c888004c347dbbb8192a5c904545711080fa392c6d9bc737.elf | upx |
| static1/unpack001/b6cd1f6205a17905609ce2e082a3d4552af2023c434d3f05df371adb2c5987e4.elf | upx |
| static1/unpack001/b8abb9661b5320f40059055bcc8f5d22259ea3ec4f8b4d0eb91523418489bcf3.elf | upx |
| static1/unpack001/b9b4673ff9380064701fa96554ee5d36f701e036b8f76c5585f6767854889105.elf | upx |
| static1/unpack001/babcc9014b04c955a174b143bd9165f0e2c6cd77e26f5ab082986fc0313b2312.elf | upx |
| static1/unpack001/c755138ad63de80e55ad0c99049151cb918ed6d2346335b5ee39beb0326388e8.elf | upx |
| static1/unpack001/cc3501048481f0cb1b33fe20a7ac827fb42d6f4365c04d83463f2e1eddd04e18.elf | upx |
| static1/unpack001/cfc3263e2f161d833b591666dee425b2e8b62d708c39b362b500512441119ca9.elf | upx |
| static1/unpack001/d4e050a3ded1ec2d38cba954b4868dc6cc7352241b3fefc56b1324c1094aaea5.elf | upx |
| static1/unpack001/e4dafea0263823affefe445b40ea002c5f63b785cb3b18270b045b86b22ba682.elf | upx |
| static1/unpack001/e500b83db91a16021dc5f38a5cfacd4262a43c34bba5fa7211409e0ace06c85a.exe | upx |
| static1/unpack001/f0bdd1cbfdf5abdf1752a6002a66122e3f5cf70349ea263f2b41b2c73bf20dee.elf | upx |
| description | ioc |
|---|---|
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW |
AutoIT scripts compiled to PE executables.
| resource | yara_rule |
|---|---|
| static1/unpack001/039cf1e827f8a2bcf066d1b64e92b333a5973fe9ada6c0f6a6bef4020925355b.exe | autoit_exe |
| static1/unpack001/2207af79bef87871aac8ac795c010aeb4d0a21e3b34ff233bf63c4e4b5c2c5b2.exe | autoit_exe |
| static1/unpack001/2d591c9eb9c192c99f9e76d14bc9e8632c18aaa863808e0d1d39a8950283c6e8.exe | autoit_exe |
| static1/unpack001/3df3b7abf812cc4840623c526ac35442a5ceb2617cbc508719ad181e111cfeff.exe | autoit_exe |
| static1/unpack001/449ecf2471ec8a48d115b252928053edc56f2bbf622a88db78274bdf3cc574ac.exe | autoit_exe |
| static1/unpack001/57e9cd4097b50b6c174ec06bd21cd8f9f0583f92dd8ec3da4e3c93a9c820bd2a.exe | autoit_exe |
| static1/unpack001/6674febb46a74c6d0f20b2b92ff5d89f334b02b9ee9cd8011cf388e993b566b6.exe | autoit_exe |
| static1/unpack001/9f708fc26f51a62c4255027c9e07cdc9c885c0453da450735795153ae33f0366.exe | autoit_exe |
| static1/unpack001/b425d419b3c6bafe0bf7d6fbd92832942f1f77eed32625715a551550b5d02dda.exe | autoit_exe |
| static1/unpack001/d3e3dc900b4bfbec43e635f49fd55913e11e748f677b4e4035fdf774a1ed6fb6.exe | autoit_exe |
| static1/unpack001/d49072a6852ca5136c43e6ff5ad83ae81ee47ca295698f2827187451c7241ee1.exe | autoit_exe |
| static1/unpack001/e5b92c64269cc60d8db665c2a71cf0b7c917bb0585d833324f6e8c3a1d22025a.exe | autoit_exe |
| static1/unpack001/ef8648a4e11f17606230b349943910c02f3a26faab05f00f779c6802f03eca97.exe | autoit_exe |
| resource | yara_rule |
|---|---|
| static1/unpack001/c53c627eddfb4635d0437c6fffa45d006077828b3d6f5bac0278210993a2bd42.exe | pyinstaller |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/02a690404a3d82ed7aef87f8518cac02809384d6b0550a36fc837c8552255d3d.exe |
| unpack001/02e3a95647684ad0501b2e25d0ff6afe117e8ae38c892f3416f174baafb8445d.exe |
| unpack001/039cf1e827f8a2bcf066d1b64e92b333a5973fe9ada6c0f6a6bef4020925355b.exe |
| unpack001/078981526fd0969e928c1b785c9e1da97ff159248dabf04132ea8fab9347acf6.exe |
| unpack001/07e5ccafd9ac5416dce0c5c04eba91ba647cb00fdac7fb67b11b1d42729beeab.exe |
| unpack001/0932f5d800ebb0e22e6323f1e64bdf3b6125b2e9b205d9f333f1857da72d7516.exe |
| unpack001/096a3baa4ba3d03b673524a281f63fa16e15a7880e5174a8679db9193eb48a75.exe |
| unpack001/0993d4c07d308fe8dffae59c2bcea46471d87eb128e0212a295941bd7703733e.exe |
| unpack001/0a0070a22c28587c932cde74814087abf7089964f35f51c350da68cc3ab9684c.exe |
| unpack001/0d9afb99c21cfef2b0930b5229e5f2f2051e5663d1be074a1be9d0099945bfef.exe |
| unpack001/101da1fc6c2b5289bca646cabead73af514b63c341e7572a071b26cd649e42e1.exe |
| unpack001/12b07fe74110ebf9b5547f87732613d5f9f5d5dd6a8cc62bd014e26e92e913c5.exe |
| unpack001/189b5f3cb70793fea771d2e0b5db4dc2fd2695f1c7510e35437e3a2f634e9536.exe |
| unpack001/1936d057c09f17db16fe499af609d5935d0b17e62f4199999543f0459cb43b05.exe |
| unpack001/1b2879fe198c51148dbe3d08946df84117f6663c2c4b0322784604442c286d39.exe |
| unpack001/1b61bb7a551bc826162e9811cd78cc27d21292de8e9516bac165090d465d2e10.exe |
| unpack001/1d4dcaf2b07cab6f785c4607040b90d2e87a2d94c3368dd57f89c97a6d77bbe3.dll |
| unpack001/1f2f38766e7ed058845430f9a50b1e5a924632a248570b5d34be000633ed7165.exe |
| unpack001/2132f7ef747d47bb65a9525dccacf04e967102d6de055179f80d8cbf62a65b76.exe |
| unpack001/21b76072ea2bf0e71af90604ee83f2627a53cdbd100300eeffb6d9580c98f795.exe |
| unpack001/2207af79bef87871aac8ac795c010aeb4d0a21e3b34ff233bf63c4e4b5c2c5b2.exe |
| unpack001/23b02a697196412dc72b191d239a55d791a819e8aea8a1ed636f2a8182c834d1.exe |
| unpack001/2515eaa2524af3e606406d5e0b7d20565d6c1a2a06903a4ff0d0fceaba7414b8.exe |
| unpack001/256d53d0669bbe5e81ae5dbf52e1edfa07126f22c1b3455e6d1189c663b33064.dll |
| unpack001/25ab561d014bdd7b50d5fa913d111bcb4dd3e41d22a5850764a7659aece4d33f.exe |
| unpack001/2666313476c89dd173b3f45ba544de734644a5f3584b8a6c918176d0a61f698e.exe |
| unpack001/2900e0153c26e219faef9110b4e8460c13958665f4e76a9534ad0ea8a0b4f8c5.exe |
| unpack001/2950ce9dbfde412f661b84dd8764fa9994c2a8edd92fea05a7f2c364420b151c.exe |
| unpack001/2b1056d4345ad77e4307f89a6e9181b96f20d7b82d4fec18dbc9be1e0636b0b7.dll |
| unpack001/2d591c9eb9c192c99f9e76d14bc9e8632c18aaa863808e0d1d39a8950283c6e8.exe |
| unpack001/30d2c8eb828cdcc0768a51196c11ac26ec0d5d4408db7b9a1e53d3668d83cf31.exe |
| unpack001/326068aa434690c190e1784ac4eef5198e550e41b7189738879ed042ed97e732.exe |
| unpack001/340f4a7db0024413428f3663d06af5d5b430a2dadc8931a8b6c75b650e951f69.exe |
| unpack001/344bb8ae2d9afbf9f666a844f6e9a7606eaa226a0383b84cf173f0f3725fabff.exe |
| unpack001/37ab61ae86c08d6a684fff573cbd927b144dfac5006d660cc3cb58676fb15c2c.exe |
| unpack001/3c1141fdf73eba7509dcb6ddf63c9622b16496803274e47700d4d4915a2725e2.exe |
| unpack001/3df3b7abf812cc4840623c526ac35442a5ceb2617cbc508719ad181e111cfeff.exe |
| unpack001/41612cf82710561b8aaaa63eccb4749f1e462270fe4525f97f19bee196764774.exe |
| unpack001/4320ef536d6736f88ed5018198c723c9c6d046d6c00ca97fe9b4fbb6482114ac.exe |
| unpack001/4416b9214d72b07c657a7916e033c4e5487e6049eb263c7a813ae673026a6fea.exe |
| unpack001/449ecf2471ec8a48d115b252928053edc56f2bbf622a88db78274bdf3cc574ac.exe |
| unpack001/478bdcdd85ddc7287b5dde32391881591cc77db75412ef5340f5bd3531738245.exe |
| unpack001/4b7ba4a99e9ce1f3363fb89f18c3b0ec0af1fe4466ae14f8466e2a7cf23eb825.exe |
| unpack001/4edc1f0904f3ea0305ff2ca311db86ed8abb8b05aadef0599e0015fff0620403.exe |
| unpack001/4ff2b35479cd45520aa714643c2dcb649e7d73caf9a6ab1c83d73ec439b6121b.exe |
| unpack001/57e9cd4097b50b6c174ec06bd21cd8f9f0583f92dd8ec3da4e3c93a9c820bd2a.exe |
| unpack001/595c20f94db2ba132681d1b669ddd21a561f50a5afd4df0925fe8fd2d988f3c6.exe |
| unpack001/5d94973c1721adf02c34669a00c29e5aae5010a71f79ca8ae16994edccec2830.exe |
| unpack001/5e8119622389d8ee840a2e9429a31d5fad907bd25c2fff9e81f969a6111af092.exe |
| unpack001/5f170a259ed79735753b3795bf9fa7c4fc1d0924e907161d90f89e097ec54fc3.exe |
| unpack001/6048838a96507ca26c12c642663939ccceba50c27fda8af018b6a05ffedf7c24.exe |
| unpack001/616022de766bd55945033159a2ef9220e9987a03fb88c89e57d9784629b965bd.exe |
| unpack001/63df257d05c5ae9f6e76314a3a44c2fb7bf1a1ef78ffa687fc0bf35f331639e4.exe |
| unpack001/6674febb46a74c6d0f20b2b92ff5d89f334b02b9ee9cd8011cf388e993b566b6.exe |
| unpack001/6a0b8f403b660202a6d599aa998802af71064fa3cdbbc2377b75885149cf1773.exe |
| unpack001/6a8e67efe93ced793d9a285c68a6c62208d185f72eb39a110defe97138b917a8.exe |
| unpack001/6b7c969bbcd1395769e6c8a03148cad3c2290bffcd4991a7383d397cb7c105c5.exe |
| unpack001/70dcd8ca36ef88c90b42a117ee5313ee0256bcb9b67ae7e6aca428e5927a8982.exe |
| unpack001/7307275801a4b5c3c6c5039b9417479952cd36dcc365a74fdcb72cad35d0a423.exe |
| unpack001/73e175be77f4507c8f8dc13d0ab2a15b86e35ff9717a750f71a9dac8d31c3f32.exe |
| unpack001/742eebfa844751ac27dd63859b04cc6d7aa4baf2ef798ef257ac07ac8b167b43.exe |
| unpack001/75f22523ab64e7eaca89fd03bdc6d32c1594d82d2f6f6a65834cb00cde74885c.exe |
| unpack001/79f16c7e9e15bdae4963e258d3c2fd5c797fea4350d81e26f64cd19686832f5c.exe |
| unpack001/7b78d121a7fff35d2efdbabeac9ace888d0c6e917b27a258058cd4b075ebcb71.exe |
| unpack001/7de8bedc1d2107a51363439e1f9c58e0631256b3bb6141545e953d25570e4511.exe |
| unpack001/7eda96196aba8ede36cfb15ac508debe75927d0b2997ef9c494d0223fb478dd3.exe |
| unpack001/7f6c6e054579e9cb04200a5179117b8e17dbdddb0c280e85f7fe9d77a5a90079.exe |
| unpack001/80c40f9a2f2bbf92496d9b8d50158885f8cfe845c54680851892287491370d58.exe |
| unpack001/832506397be8817683e8dcac4604eaee19f0add472b9332cb667067562487896.exe |
| unpack001/8348a12f9db7da150a1920718df15448bc7fe34dbe4bc8b788f3d269f940fa3c.exe |
| unpack001/8418a0391b5cca38e10e71d95d1a02e5e06849d3c5299c3ceb8ac012b2ad7a0f.exe |
| unpack001/88a2bc6a71b781818a170e74b81b01e99a6d018d1b095652557fb1afcd1e0d9d.exe |
| unpack001/8940574ca19d087350f6914af877bb4dcdaa32268ac4b35e9de2dc80590d7087.exe |
| unpack001/8a93fc1f94b6919a6776d6d0151d04a352d30a8743d58ff9090d3def3c2aa571.exe |
| unpack001/8e59e63c053985a8553a063e09afad261e9cd0f4a40fafd333ea0b705c483573.exe |
| unpack001/9033b9abad982d94ad4172788694b6d365c7917cd3a9d5532a7507dc48b2df2a.exe |
| unpack001/91b03fbfec8d0fb1c1e6bb9ceb9893f26807c160809bcb8d71f2217960399e30.exe |
| unpack001/91ff4b06f7998bb1adb5e183e8b3440a5f7fa743190f31f58ddf3fada68e51e4.exe |
| unpack001/924d37ab763e5093673e647251deab171e2d03926ba159593e6352373c29de00.exe |
| unpack001/9911129661bce9c536c1232b12b2aa19501d9dfae099c146d25308c7bb6839ac.exe |
| unpack001/9a6f5a1bda6fe4c8c596e025cd42e04911e01be388b3bda780279f92c0ef4f23.exe |
| unpack001/9bf4636e2be3154a2c956982b1e547b7206b73bce86a42ce6573404c1773ce40.exe |
| unpack001/9c051c1f0938d57caab88ddf7c68456838889f84907436aa6dbf50b1e35ea6ab.exe |
| unpack001/9c20710607760934fbc59a5b6e60ff8ba2441b6f5ab2de182bca1e18209e9150.exe |
| unpack001/9d521333a79d744ede01a133eded8bf562e739bc93af8695acf2342d96f80d99.dll |
| unpack001/9e31a71a7c453bfce6b1ddf343b056cfbfc89ae83c5c5529d90949161ab1e9fa.exe |
| unpack001/9ed76d0cdb1f2b686adb7739764e2bdde84c7497b753cdd92ebefd5efea9b378.exe |
| unpack001/9f121f9e36a53eb08ff86c94cf9678245d0c1d56670118d44351bea52e74aec7.exe |
| unpack001/9f708fc26f51a62c4255027c9e07cdc9c885c0453da450735795153ae33f0366.exe |
| unpack001/a03e517dd3772d7f304c77676c7cb50e5dbf146d67a4812eb2bf7ec9a9641520.exe |
| unpack001/a0c35404de8e296472b68d8d640c1b172055cd7837909907ac45c4ed05c88a43.exe |
| unpack001/a25788e0fb0fd993fa396565fc7c8013dd70651443df2f7dc77c56ad6f07bdc8.exe |
| unpack001/a3259c28c735b4fc77af61b4d5e2331bfb2ca8e6fc9be6fea650f01c5ac54eb8.exe |
| unpack001/a510274771924b5532277575790faef750bbbb8cccd6cd773bdb7b1572150647.dll |
| unpack001/a79fbf1f6682f02689ef3400ff89f2c960b595b7498af36fb1a418fa0e7e0549.exe |
| unpack001/a7d7918287e20b0dba642c291b6e7efc6e73222cf5ed02254926b898c9107d5f.exe |
| unpack001/aa11e9d5b84487e28b0e003406b3a8d3d595ed9a9f1234a567548fa57aa06ce1.exe |
| unpack001/ace9e8a629f6ba8882afc43198dc9f7e6bf3b723140c2ed28ad36cf2f5786c93.dll |
| unpack001/b16c9c6b0d2c5e04fd3d3bcfb9f9a8712502b99a1fea9edf9a2ff1dd1cc8ed41.exe |
| unpack001/b25e0f52dc61ee0a114de10fd27d6783c6910b8f34616f9ea9ef04fd6649bb3c.exe |
| unpack001/b38cd79476d02cd0203566b46589befe82d8f88b85a4aaf361007aaf5aeffef6.exe |
| unpack001/b425d419b3c6bafe0bf7d6fbd92832942f1f77eed32625715a551550b5d02dda.exe |
| unpack001/b475bbe8df1e693355babceffa61f6411f8eacc029fa3b0df1e53dba350d2e62.exe |
| unpack001/b4c0af25d74cc62a4cdeeac0a7b19c6f2944fb9596e46908410b90bf540fa1a6.exe |
| unpack001/b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b.exe |
| unpack001/b82adeb64feb86d3db0d37c4349b349b41ddf16b865ed980a115a9a2952f5b7f.exe |
| unpack001/b919be4df2b321304c804b9af68e6c5da6c03a821381c30cfc2d9d0fb042e0d1.exe |
| unpack001/bc5eea66e42ed9ccc98b9692c4b5e5c198b1bed42052f696c2161789a4fdba25.exe |
| unpack001/c3540a76dd237e9df12b0aef03a65b95dbcc67ed59e4720cb2c9ae065c2564ae.exe |
| unpack001/c36d9a5680ece3f4ceb44ed997961422d13e6b7eba7ea1d678a0efc561934194.exe |
| unpack001/c53c627eddfb4635d0437c6fffa45d006077828b3d6f5bac0278210993a2bd42.exe |
| unpack001/c5fc537060561b1860ac757f31b3dc86f22efab2c5186569f997ecd83fedf697.exe |
| unpack001/c6b066e441a2740f87cfa1e2a8da69a5dc7814411088d3f69c4d9fe9d2bf2ce4.exe |
| unpack001/c70f9b94806694a6376ff44967ea1fcadb966d436e49cc04c32aa9b828360acd.exe |
| unpack001/c846901a49c2366de9e754a6ca741a8dcaf5ce6a927dc2b32fff40ae321b06ff.exe |
| unpack001/c8ff44d83e4e95fe4b651a3b2c12aea8e3082688615fdf865f0a01de484910d0.exe |
| unpack001/cc7d30067401f6969ead8a72184ba73a47be7faf7be5464464315ec9cecd5932.exe |
| unpack001/cef570542198bfab9319da2c3068da34484f72d77e5437f3f0592d26b26aaf69.exe |
| unpack001/cfc804c7fea469061d40fa067369c0f422ef9ddc4444880ab6e532a815755f67.exe |
| unpack001/d3e3dc900b4bfbec43e635f49fd55913e11e748f677b4e4035fdf774a1ed6fb6.exe |
| unpack001/d49072a6852ca5136c43e6ff5ad83ae81ee47ca295698f2827187451c7241ee1.exe |
| unpack001/d607b4eddf572f2fec9793349518180df59d795f58fce6223e8183ebf45b7e6c.exe |
| unpack001/d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe |
| unpack001/d9e11bf6dbbb2e9e75574f370b57e32efd4be3b1ba193b934933515aed9b933e.exe |
| unpack001/d9e9ad2e1129ea6aa884668a13f6e3b73b7cedaa7fec69a38c4e683bea546879.exe |
| unpack001/dae4facd24ebff0352f1c58ed73a8f060cb86b5c9895bce9e78a273f7ac627a5.exe |
| unpack001/dc35bb3e599d118d48f019a8abf13ad6ad56920ec366406a841b2aac785324df.exe |
| unpack001/dfef81de68b9aaf054df713c596c3902f3f92156d7cf041f903188b32a35e4a9.exe |
| unpack001/e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe |
| unpack001/e268df66fb92ff6e5b2719279c5bee5383d56a4b97add2c7dc0ede45d2aec175.exe |
| unpack001/e500b83db91a16021dc5f38a5cfacd4262a43c34bba5fa7211409e0ace06c85a.exe |
| unpack001/e586bf17566b9188b9274097ddf059cf20569b87754f38e460c2fd884ae88a15.exe |
| unpack001/e5b92c64269cc60d8db665c2a71cf0b7c917bb0585d833324f6e8c3a1d22025a.exe |
| unpack001/e6152cc4702000546accc8d72aed7cb2a17381fbfed6b2dae32a336e15440549.exe |
| unpack001/e7757fdf8b8e6b584cab959c54383e10065ba2aceb5dd653dd0566d4cbce1ec8.exe |
| unpack001/e8ba4a43b8c03e1ea3ab83bed7c1c415cd17a289293a1e0e351da3ba85683eab.exe |
| unpack001/ec291f72135b5826eae935f229e4c1bc2bc14d3671c9001452be407fc130ca3b.exe |
| unpack001/ec36ebae6ef6f254f20c4a444c17db05be30a0acbbaf33f5f568608a38452d7c.exe |
| unpack001/ef8648a4e11f17606230b349943910c02f3a26faab05f00f779c6802f03eca97.exe |
| unpack001/f297ff70bf504f4de6493af8ee41f6db917d6c849436c88caaaeda0bc779d599.exe |
| unpack001/f571ec60e80f59ca67e085d6578306da2af3de4e3c9b48714dc20ade153fed35.exe |
| unpack001/f953f4ede7a4cf9640cef3c513c62e9c592dfff4a9e4fd2549d3507a7def18b8.exe |
| unpack001/fa72ce2ca8b2c02af5ed2b6c6b7d5ebef09db6853681dd0681e42886fde0a8a5.exe |
| unpack001/fab70e91670f8a5c0d6740f05592ea1fd44776d3fce3be0a200c9ce81f1eb3d5.exe |
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
AutoIT Executable
AutoIT scripts compiled to PE executables.
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=25, id=171, productName=VS2010 build 30319, version=30319,
count=19, id=158, productName=VS2010 build 30319, version=30319,
count=108, id=170, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=104, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
Detected Gafgyt variant
Unsigned PE
Checks for missing Authenticode signature.
Mar 16, 2019
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Mar 16, 2019
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=259, version=30795,
count=193, id=261, version=30795,
count=1, id=263, version=30795,
count=4, id=253, version=31823,
count=18, id=260, version=31823,
count=24, id=259, version=31823,
count=85, id=261, version=31823,
count=25, id=260, version=30795,
count=1, id=262, version=30795,
count=25, id=257, version=30795,
count=282, id=1, productName=Unmarked objects,
count=28, id=265, version=31947,
count=1, id=255, version=31947,
count=1, id=151,
count=1, id=258, version=31947,
Feb 22, 2024
Feb 22, 2024
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=260, version=27412,
count=1, id=262, version=27412,
count=41, id=261, version=26706,
count=18, id=260, version=26706,
count=17, id=259, version=26706,
count=15, id=257, version=27412,
count=212, id=1, productName=Unmarked objects,
count=2, id=259, version=27045,
count=4, id=260, version=27045,
count=49, id=261, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
AutoIT Executable
AutoIT scripts compiled to PE executables.
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=51, id=223, productName=VS2013 build 21005, version=21005,
count=177, id=224, productName=VS2013 build 21005, version=21005,
count=53, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=544, id=1, productName=Unmarked objects,
count=80, id=234, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
Detected Gafgyt variant
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=25, id=171, productName=VS2010 build 30319, version=30319,
count=19, id=158, productName=VS2010 build 30319, version=30319,
count=108, id=170, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=104, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=26715,
count=136, id=261, version=26715,
count=18, id=260, version=26715,
count=15, id=260, version=28117,
count=17, id=259, version=28117,
count=33, id=261, version=28117,
count=7, id=257, version=26715,
count=97, id=1, productName=Unmarked objects,
count=3, id=265, version=28315,
count=1, id=256, productName=VS2019 v16.4.3 build 28315, version=28315,
count=1, id=255, productName=VS2019 v16.4.3 build 28315, version=28315,
count=1, id=258, productName=VS2019 v16.4.3 build 28315, version=28315,
Detect ZGRat V1
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=241, version=40116,
count=142, id=243, version=40116,
count=24, id=242, version=40116,
count=2, id=253, version=30625,
count=19, id=260, version=30625,
count=23, id=259, version=30625,
count=52, id=261, version=30625,
count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=277, id=1, productName=Unmarked objects,
count=49, id=261, version=30709,
count=1, id=256, version=30709,
count=1, id=255, version=30709,
count=1, id=258, version=30709,
Unsigned PE
Checks for missing Authenticode signature.
Detected Gafgyt variant
Unsigned PE
Checks for missing Authenticode signature.
count=25, id=171, productName=VS2010 build 30319, version=30319,
count=19, id=158, productName=VS2010 build 30319, version=30319,
count=108, id=170, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=104, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
May 12, 2021
CN=Blix Inc.,O=Blix Inc.,POSTALCODE=19711,STREET=40 E Main Street,L=Newark,ST=Delaware,C=US
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=Blix Inc.,O=Blix Inc.,POSTALCODE=19711,STREET=40 E Main Street,L=Newark,ST=Delaware,C=US
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
May 12, 2021
CN=Blix Inc.,O=Blix Inc.,POSTALCODE=19711,STREET=40 E Main Street,L=Newark,ST=Delaware,C=US
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=Blix Inc.,O=Blix Inc.,POSTALCODE=19711,STREET=40 E Main Street,L=Newark,ST=Delaware,C=US
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Unsigned PE
Checks for missing Authenticode signature.
Office macro that triggers on suspicious action
Office document macro which triggers in special circumstances - often malicious.
Mar 16, 2019
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Mar 16, 2019
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Feb 26, 2010
count=1, id=150, version=20413,
count=46, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=19, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=106, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=123, productName=VS2005 build 50727, version=50727,
count=177, id=1, productName=Unmarked objects,
count=5, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=151,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
AutoIT Executable
AutoIT scripts compiled to PE executables.
Unsigned PE
Checks for missing Authenticode signature.
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
Feb 21, 2024
Unsigned PE
Checks for missing Authenticode signature.
count=25, id=171, productName=VS2010 build 30319, version=30319,
count=19, id=158, productName=VS2010 build 30319, version=30319,
count=108, id=170, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=104, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Detected Gafgyt variant
Mar 16, 2019
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Mar 16, 2019
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Detected Gafgyt variant
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=259, version=30795,
count=193, id=261, version=30795,
count=1, id=263, version=30795,
count=4, id=253, version=31823,
count=18, id=260, version=31823,
count=24, id=259, version=31823,
count=85, id=261, version=31823,
count=25, id=260, version=30795,
count=1, id=262, version=30795,
count=25, id=257, version=30795,
count=282, id=1, productName=Unmarked objects,
count=28, id=265, version=31947,
count=1, id=255, version=31947,
count=1, id=151,
count=1, id=258, version=31947,
Mar 16, 2019
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Mar 16, 2019
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Feb 22, 2024
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Feb 7, 2024
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
AutoIT Executable
AutoIT scripts compiled to PE executables.
Unsigned PE
Checks for missing Authenticode signature.
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
Unsigned PE
Checks for missing Authenticode signature.
count=25, id=171, productName=VS2010 build 30319, version=30319,
count=19, id=158, productName=VS2010 build 30319, version=30319,
count=108, id=170, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=104, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Detected Gafgyt variant
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
AutoIT Executable
AutoIT scripts compiled to PE executables.
Unsigned PE
Checks for missing Authenticode signature.
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
Detected Gafgyt variant
Unsigned PE
Checks for missing Authenticode signature.
Nov 9, 2023
CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Nov 9, 2023
CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Mar 8, 2017
SERIALNUMBER=116-81-65189,CN=PENTA SECURITY SYSTEMS INC.,O=PENTA SECURITY SYSTEMS INC.,L=Yeongdeungpo-gu,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52
CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Mar 8, 2017
SERIALNUMBER=116-81-65189,CN=PENTA SECURITY SYSTEMS INC.,O=PENTA SECURITY SYSTEMS INC.,L=Yeongdeungpo-gu,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52
CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Detected Gafgyt variant
Mar 16, 2019
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Mar 16, 2019
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Feb 21, 2024
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=166, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Detected Gafgyt variant
AutoIT Executable
AutoIT scripts compiled to PE executables.
Unsigned PE
Checks for missing Authenticode signature.
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
Detected Gafgyt variant
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=25, id=171, productName=VS2010 build 30319, version=30319,
count=19, id=158, productName=VS2010 build 30319, version=30319,
count=108, id=170, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=104, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
AutoIT Executable
AutoIT scripts compiled to PE executables.
Unsigned PE
Checks for missing Authenticode signature.
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Detected Gafgyt variant
Unsigned PE
Checks for missing Authenticode signature.
count=25, id=171, productName=VS2010 build 30319, version=30319,
count=19, id=158, productName=VS2010 build 30319, version=30319,
count=108, id=170, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=104, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=259, version=30795,
count=193, id=261, version=30795,
count=1, id=263, version=30795,
count=4, id=253, version=31823,
count=18, id=260, version=31823,
count=24, id=259, version=31823,
count=85, id=261, version=31823,
count=25, id=260, version=30795,
count=1, id=262, version=30795,
count=25, id=257, version=30795,
count=282, id=1, productName=Unmarked objects,
count=28, id=265, version=31947,
count=1, id=255, version=31947,
count=1, id=151,
count=1, id=258, version=31947,
Unsigned PE
Checks for missing Authenticode signature.
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=30, id=261, version=31616,
count=10, id=260, version=31616,
count=4, id=259, version=31616,
count=6, id=257, version=31616,
count=17, id=257, version=27412,
count=196, id=1, productName=Unmarked objects,
count=11, id=261, version=31630,
count=1, id=255, version=31630,
count=1, id=258, version=31630,
Unsigned PE
Checks for missing Authenticode signature.
Apr 25, 2023
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
count=8, id=259, version=30795,
count=188, id=261, version=30795,
count=10, id=260, version=30795,
count=4, id=253, version=32533,
count=40, id=261, version=32533,
count=17, id=260, version=32533,
count=9, id=259, version=32533,
count=11, id=257, version=30795,
count=139, id=1, productName=Unmarked objects,
count=21, id=260, version=32826,
count=1, id=258, version=32826,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Detected Gafgyt variant
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=259, version=30795,
count=193, id=261, version=30795,
count=1, id=263, version=30795,
count=4, id=253, version=31823,
count=18, id=260, version=31823,
count=24, id=259, version=31823,
count=85, id=261, version=31823,
count=25, id=260, version=30795,
count=1, id=262, version=30795,
count=25, id=257, version=30795,
count=282, id=1, productName=Unmarked objects,
count=28, id=265, version=31947,
count=1, id=255, version=31947,
count=1, id=151,
count=1, id=258, version=31947,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=7, id=260, version=33030,
count=3, id=259, version=33030,
count=23, id=261, version=33030,
count=5, id=257, version=33030,
count=6, id=257, version=30795,
count=143, id=1, productName=Unmarked objects,
count=3, id=261, version=33133,
count=1, id=255, version=33133,
count=1, id=151,
count=1, id=258, version=33133,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=25, id=171, productName=VS2010 build 30319, version=30319,
count=19, id=158, productName=VS2010 build 30319, version=30319,
count=108, id=170, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=104, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Detected Gafgyt variant
Detected Gafgyt variant
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=259, version=30795,
count=193, id=261, version=30795,
count=1, id=263, version=30795,
count=4, id=253, version=31823,
count=18, id=260, version=31823,
count=24, id=259, version=31823,
count=85, id=261, version=31823,
count=25, id=260, version=30795,
count=1, id=262, version=30795,
count=25, id=257, version=30795,
count=282, id=1, productName=Unmarked objects,
count=28, id=265, version=31947,
count=1, id=255, version=31947,
count=1, id=151,
count=1, id=258, version=31947,
Unsigned PE
Checks for missing Authenticode signature.
count=17, id=259, version=26715,
count=160, id=261, version=26715,
count=18, id=260, version=28117,
count=23, id=259, version=28117,
count=117, id=261, version=28117,
count=21, id=260, version=26715,
count=19, id=257, version=26715,
count=212, id=1, productName=Unmarked objects,
count=1, id=265, version=28315,
count=1, id=255, productName=VS2019 v16.4.3 build 28315, version=28315,
count=1, id=258, productName=VS2019 v16.4.3 build 28315, version=28315,
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=259, version=30795,
count=193, id=261, version=30795,
count=1, id=263, version=30795,
count=4, id=253, version=31823,
count=18, id=260, version=31823,
count=24, id=259, version=31823,
count=85, id=261, version=31823,
count=25, id=260, version=30795,
count=1, id=262, version=30795,
count=25, id=257, version=30795,
count=282, id=1, productName=Unmarked objects,
count=28, id=265, version=31947,
count=1, id=255, version=31947,
count=1, id=151,
count=1, id=258, version=31947,
Detected Gafgyt variant
Detected Gafgyt variant
Detected Gafgyt variant
Unsigned PE
Checks for missing Authenticode signature.
count=25, id=171, productName=VS2010 build 30319, version=30319,
count=19, id=158, productName=VS2010 build 30319, version=30319,
count=108, id=170, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=104, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=259, version=30795,
count=193, id=261, version=30795,
count=1, id=263, version=30795,
count=4, id=253, version=31823,
count=18, id=260, version=31823,
count=24, id=259, version=31823,
count=85, id=261, version=31823,
count=25, id=260, version=30795,
count=1, id=262, version=30795,
count=25, id=257, version=30795,
count=282, id=1, productName=Unmarked objects,
count=28, id=265, version=31947,
count=1, id=255, version=31947,
count=1, id=151,
count=1, id=258, version=31947,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Detected Gafgyt variant
Feb 22, 2024
count=10, id=259, version=27412,
count=141, id=261, version=27412,
count=18, id=260, version=27412,
count=17, id=260, version=31616,
count=19, id=259, version=31616,
count=40, id=261, version=31616,
count=5, id=257, version=27412,
count=104, id=1, productName=Unmarked objects,
count=1, id=265, version=31629,
count=1, id=255, version=31629,
count=1, id=151,
count=1, id=258, version=31629,
Unsigned PE
Checks for missing Authenticode signature.
Feb 22, 2024
count=14, id=259, version=30795,
count=170, id=261, version=30795,
count=85, id=261, version=31823,
count=19, id=260, version=31823,
count=24, id=259, version=31823,
count=23, id=260, version=30795,
count=31, id=257, version=30795,
count=400, id=1, productName=Unmarked objects,
count=2, id=260, version=31943,
count=31, id=261, version=31943,
count=1, id=255, version=31943,
count=1, id=151,
count=1, id=258, version=31943,
Mar 16, 2019
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Mar 16, 2019
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=259, version=30795,
count=193, id=261, version=30795,
count=1, id=263, version=30795,
count=4, id=253, version=31823,
count=18, id=260, version=31823,
count=24, id=259, version=31823,
count=85, id=261, version=31823,
count=25, id=260, version=30795,
count=1, id=262, version=30795,
count=25, id=257, version=30795,
count=282, id=1, productName=Unmarked objects,
count=28, id=265, version=31947,
count=1, id=255, version=31947,
count=1, id=151,
count=1, id=258, version=31947,
Unsigned PE
Checks for missing Authenticode signature.
Mar 16, 2019
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Mar 16, 2019
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Detect ZGRat V1
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Detected Gafgyt variant
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=259, version=30795,
count=193, id=261, version=30795,
count=1, id=263, version=30795,
count=4, id=253, version=31823,
count=18, id=260, version=31823,
count=24, id=259, version=31823,
count=85, id=261, version=31823,
count=25, id=260, version=30795,
count=1, id=262, version=30795,
count=25, id=257, version=30795,
count=282, id=1, productName=Unmarked objects,
count=28, id=265, version=31947,
count=1, id=255, version=31947,
count=1, id=151,
count=1, id=258, version=31947,
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=259, version=30795,
count=193, id=261, version=30795,
count=1, id=263, version=30795,
count=4, id=253, version=31823,
count=18, id=260, version=31823,
count=24, id=259, version=31823,
count=85, id=261, version=31823,
count=25, id=260, version=30795,
count=1, id=262, version=30795,
count=25, id=257, version=30795,
count=282, id=1, productName=Unmarked objects,
count=28, id=265, version=31947,
count=1, id=255, version=31947,
count=1, id=151,
count=1, id=258, version=31947,
AutoIT Executable
AutoIT scripts compiled to PE executables.
Unsigned PE
Checks for missing Authenticode signature.
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=259, version=30795,
count=193, id=261, version=30795,
count=1, id=263, version=30795,
count=4, id=253, version=31823,
count=18, id=260, version=31823,
count=24, id=259, version=31823,
count=85, id=261, version=31823,
count=25, id=260, version=30795,
count=1, id=262, version=30795,
count=25, id=257, version=30795,
count=282, id=1, productName=Unmarked objects,
count=28, id=265, version=31947,
count=1, id=255, version=31947,
count=1, id=151,
count=1, id=258, version=31947,
Detected Gafgyt variant
Unsigned PE
Checks for missing Authenticode signature.
Detected Gafgyt variant
Detected Gafgyt variant
Detected Gafgyt variant
Unsigned PE
Checks for missing Authenticode signature.
Feb 6, 2024
count=44, id=259, version=27412,
count=215, id=261, version=27412,
count=3, id=253, version=28518,
count=20, id=260, version=30034,
count=28, id=259, version=30034,
count=98, id=261, version=30034,
count=2, id=253, version=23601,
count=47, id=260, version=27412,
count=1, id=262, version=27412,
count=44, productName=Unmarked objects (old),
count=37, id=257, version=27412,
count=705, id=1, productName=Unmarked objects,
count=283, id=260, version=30147,
count=386, id=261, version=30147,
count=1, id=255, version=30147,
count=2, id=151,
count=1, id=258, version=30147,
Unsigned PE
Checks for missing Authenticode signature.
count=3, id=257, version=27412,
count=29, id=1, productName=Unmarked objects,
count=3, id=259, version=27412,
count=3, id=260, version=27412,
count=3, id=261, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=258, productName=VS2019 v16.11.1 build 30133, version=30133,
Feb 21, 2024
Detected Gafgyt variant
Unsigned PE
Checks for missing Authenticode signature.
count=23, id=259, version=30795,
count=180, id=261, version=30795,
count=22, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=15, id=260, version=33030,
count=87, id=261, version=33030,
count=20, id=259, version=33030,
count=1, id=262, version=30795,
count=17, id=257, version=30795,
count=199, id=1, productName=Unmarked objects,
count=18, id=265, version=33133,
count=1, id=255, version=33133,
count=1, id=258, version=33133,
Unsigned PE
Checks for missing Authenticode signature.
Detected Gafgyt variant
Unsigned PE
Checks for missing Authenticode signature.
Nov 9, 2023
CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Nov 9, 2023
CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
AutoIT Executable
AutoIT scripts compiled to PE executables.
Unsigned PE
Checks for missing Authenticode signature.
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=259, version=30795,
count=193, id=261, version=30795,
count=1, id=263, version=30795,
count=4, id=253, version=31823,
count=18, id=260, version=31823,
count=24, id=259, version=31823,
count=85, id=261, version=31823,
count=25, id=260, version=30795,
count=1, id=262, version=30795,
count=25, id=257, version=30795,
count=282, id=1, productName=Unmarked objects,
count=28, id=265, version=31947,
count=1, id=255, version=31947,
count=1, id=151,
count=1, id=258, version=31947,
Unsigned PE
Checks for missing Authenticode signature.
count=25, id=171, productName=VS2010 build 30319, version=30319,
count=19, id=158, productName=VS2010 build 30319, version=30319,
count=108, id=170, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=104, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=259, version=30795,
count=193, id=261, version=30795,
count=1, id=263, version=30795,
count=4, id=253, version=31823,
count=18, id=260, version=31823,
count=24, id=259, version=31823,
count=85, id=261, version=31823,
count=25, id=260, version=30795,
count=1, id=262, version=30795,
count=25, id=257, version=30795,
count=282, id=1, productName=Unmarked objects,
count=28, id=265, version=31947,
count=1, id=255, version=31947,
count=1, id=151,
count=1, id=258, version=31947,
SLocker payload
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=25, id=171, productName=VS2010 build 30319, version=30319,
count=19, id=158, productName=VS2010 build 30319, version=30319,
count=108, id=170, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=104, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Detects Pyinstaller
Unsigned PE
Checks for missing Authenticode signature.
count=8, id=259, version=30795,
count=187, id=261, version=30795,
count=10, id=260, version=30795,
count=4, id=253, version=32533,
count=40, id=261, version=32533,
count=17, id=260, version=32533,
count=9, id=259, version=32533,
count=11, id=257, version=30795,
count=139, id=1, productName=Unmarked objects,
count=21, id=260, version=32825,
count=1, id=258, version=32825,
Unsigned PE
Checks for missing Authenticode signature.
count=19, id=260, version=26715,
count=16, id=259, version=26715,
count=176, id=261, version=26715,
count=70, id=261, version=28117,
count=15, id=260, version=28117,
count=9, id=259, version=28117,
count=13, id=257, version=26715,
count=193, id=1, productName=Unmarked objects,
count=4, id=265, version=28315,
count=1, id=256, productName=VS2019 v16.4.3 build 28315, version=28315,
count=1, id=255, productName=VS2019 v16.4.3 build 28315, version=28315,
count=1, id=258, productName=VS2019 v16.4.3 build 28315, version=28315,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=259, version=30795,
count=193, id=261, version=30795,
count=1, id=263, version=30795,
count=4, id=253, version=31823,
count=18, id=260, version=31823,
count=24, id=259, version=31823,
count=85, id=261, version=31823,
count=25, id=260, version=30795,
count=1, id=262, version=30795,
count=25, id=257, version=30795,
count=282, id=1, productName=Unmarked objects,
count=28, id=265, version=31947,
count=1, id=255, version=31947,
count=1, id=151,
count=1, id=258, version=31947,
Detected Gafgyt variant
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=259, version=30795,
count=193, id=261, version=30795,
count=1, id=263, version=30795,
count=4, id=253, version=31823,
count=18, id=260, version=31823,
count=24, id=259, version=31823,
count=85, id=261, version=31823,
count=25, id=260, version=30795,
count=1, id=262, version=30795,
count=25, id=257, version=30795,
count=282, id=1, productName=Unmarked objects,
count=28, id=265, version=31947,
count=1, id=255, version=31947,
count=1, id=151,
count=1, id=258, version=31947,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Mar 16, 2019
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Mar 16, 2019
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Detected Gafgyt variant
AutoIT Executable
AutoIT scripts compiled to PE executables.
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=51, id=223, productName=VS2013 build 21005, version=21005,
count=177, id=224, productName=VS2013 build 21005, version=21005,
count=53, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=544, id=1, productName=Unmarked objects,
count=80, id=234, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
AutoIT Executable
AutoIT scripts compiled to PE executables.
Unsigned PE
Checks for missing Authenticode signature.
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
Feb 21, 2024
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=259, version=30795,
count=193, id=261, version=30795,
count=1, id=263, version=30795,
count=4, id=253, version=31823,
count=18, id=260, version=31823,
count=24, id=259, version=31823,
count=85, id=261, version=31823,
count=25, id=260, version=30795,
count=1, id=262, version=30795,
count=25, id=257, version=30795,
count=282, id=1, productName=Unmarked objects,
count=28, id=265, version=31947,
count=1, id=255, version=31947,
count=1, id=151,
count=1, id=258, version=31947,
Unsigned PE
Checks for missing Authenticode signature.
count=25, id=171, productName=VS2010 build 30319, version=30319,
count=19, id=158, productName=VS2010 build 30319, version=30319,
count=108, id=170, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=104, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Detected Gafgyt variant
Unsigned PE
Checks for missing Authenticode signature.
count=11, id=241, version=40116,
count=139, id=243, version=40116,
count=24, id=242, version=40116,
count=1, id=199, version=41118,
count=22, id=259, version=24123,
count=19, id=260, version=24123,
count=44, id=261, version=24123,
count=10, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=267, id=1, productName=Unmarked objects,
count=48, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=259, version=30795,
count=193, id=261, version=30795,
count=1, id=263, version=30795,
count=4, id=253, version=31823,
count=18, id=260, version=31823,
count=24, id=259, version=31823,
count=85, id=261, version=31823,
count=25, id=260, version=30795,
count=1, id=262, version=30795,
count=25, id=257, version=30795,
count=282, id=1, productName=Unmarked objects,
count=28, id=265, version=31947,
count=1, id=255, version=31947,
count=1, id=151,
count=1, id=258, version=31947,
Jan 22, 2024
Detected Gafgyt variant
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
Unsigned PE
Checks for missing Authenticode signature.
AutoIT Executable
AutoIT scripts compiled to PE executables.
Unsigned PE
Checks for missing Authenticode signature.
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=259, version=30795,
count=193, id=261, version=30795,
count=1, id=263, version=30795,
count=4, id=253, version=31823,
count=18, id=260, version=31823,
count=24, id=259, version=31823,
count=85, id=261, version=31823,
count=25, id=260, version=30795,
count=1, id=262, version=30795,
count=25, id=257, version=30795,
count=282, id=1, productName=Unmarked objects,
count=28, id=265, version=31947,
count=1, id=255, version=31947,
count=1, id=151,
count=1, id=258, version=31947,
Unsigned PE
Checks for missing Authenticode signature.
Feb 20, 2024
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=166, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=259, version=30795,
count=193, id=261, version=30795,
count=1, id=263, version=30795,
count=4, id=253, version=31823,
count=18, id=260, version=31823,
count=24, id=259, version=31823,
count=85, id=261, version=31823,
count=25, id=260, version=30795,
count=1, id=262, version=30795,
count=25, id=257, version=30795,
count=282, id=1, productName=Unmarked objects,
count=28, id=265, version=31947,
count=1, id=255, version=31947,
count=1, id=151,
count=1, id=258, version=31947,
Unsigned PE
Checks for missing Authenticode signature.
AutoIT Executable
AutoIT scripts compiled to PE executables.
Unsigned PE
Checks for missing Authenticode signature.
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=25, id=171, productName=VS2010 build 30319, version=30319,
count=19, id=158, productName=VS2010 build 30319, version=30319,
count=107, id=170, productName=VS2010 build 30319, version=30319,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=104, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Detected Gafgyt variant
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Mar 16, 2019
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Mar 16, 2019
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB